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Abstract 

Many IS courses address the issues of ethical decision making and privacy through full course or section 
of a larger course. In this paper, the author discusses the development of a series of activities in an 
IS2010.07 course. The primary purpose of these activities is to raise awareness by the students of 
issues dealing with the collection, analysis, use, and leveraging of consumer data, including their own. 
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1. INTRODUCTION 

In the current data-intensive era, one of the 
primary ethical issues facing consumers and, in 
turn, enterprises, is the privacy of individual data. 
Privacy, as stated by Solove (2013), suffers from 
definitional ambiguity. Privacy depends highly on 
context and the individual's life experiences. In 
this paper, privacy is defined using the definition 
provided at Dictionary.com: 

"freedom from damaging publicity, public 
scrutiny, secret surveillance, or unauthorized 
disclosure of one's personal data or 
information, as by a government, corporation, 
or individual" (Dictionary.com, n.d.) 

Mason (1986) was the first to recognize that 
privacy is a major ethical issue. Mason named 
the four key ethical issues of the information age 
as: Privacy, Accuracy, Property, and Accessibility 
(PAPA). In a follow-up study, Peslak (2006) 
reaffirmed privacy as the most essential of the 
four factors to individuals. 

Surprisingly, few people (including students) are 
aware of privacy abuses that occur almost daily. 
This despite, admonishments by important people 
in IT; in 1989 Scott McNealy, co-founder and long 
serving CEO at Sun Microsystems stated, "You 
have zero privacy anyway. Get over it" (Maines, 
2000 ). 


The essence of the course activities, outlined in 
this paper, was to make students (primarily 
seniors) aware of the overt and discrete violations 
of their own privacy that happens regularly. 
Making students aware of the two edge sword of 
technology will hopefully make them better 
consumers and users of technology. 

2. CALLS TO STUDY PRIVACY/ETHICS 
/SOCIAL RESPONSIBILITY IN IT 
COURSES 

Challenges from a number of different fronts have 
been leveled recently against business schools 
(and the same argument can be made for IS/IT 
programs as well), that we are doing our students 
a disservice by not exposing them to "wicked 
problems" (McMillian & Overall, 2016). Colby et 
al. (2011) have called upon business schools to 
incorporate liberal education concepts such as 
critical thinking and "ethical sensitivity". 

In 2011, a special issue of the Journal of 
Information Systems Education (JISE) covered 
Ethics and Social Responsibility topics relevant to 
IS education. Harris, Lang, Yates, & Kruck (2011) 
stated that the articles in the special issue 
"describe how inclusion of ethics and social 
responsibility [including the topic of privacy] in 
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the IS curriculum enhances IS education" (Harris, 
et al., 2011, p. 183). 

One article, within this special issue of JISE, is 
particularly germane to this work. Fleischmann, 
Robbins, and Wallace (2011) discuss a framework 
for ethical decision making and then apply this 
framework to the development of a course outline 
to teach IT ethics from both a Western, non- 
Western, and feminist perspective. Armed with 
the Quinn (2016) text, and other outside 
readings, the authors discuss the development of 
both an undergraduate and graduate course 
concerning IT ethics. 

Many IS courses, similar in nature to the above 
discussion, incorporate ethics, and privacy, into 
the content through text supported materials. 
Most Intro to IS textbooks (Rainer, Prince, & 
Cegielski, 2013; Haag & Cumming, 2012; Sousa 
& Oz, 2014; Laudon & Laudon, 2015; Marakas & 
O'Brien, 2013) and some specialized textbooks on 
IT ethics such as Quinn (Quinn, 2016) and 
Reynolds (Reynolds, 2014) have coverage of 
these issues in various lengths and depth. 

The objectives of this work also fits the call by 
Ives, Valacich, Watson, Zmud, Alavi, et al. (2002) 
to ensure that students have this knowledge 
especially in four of the eight key concept areas: 

• How do information systems influence 
organizational competitiveness? 

• Why have databases become so important to 
modern organizations? 

• What is the role of the Internet and 
networking technology in modern 
organizations? 

• How do information systems enable 
organizational processes? 

Certainly, it can be seen that the collection 
(namely utilizing the Internet), analysis, use, and 
leveraging (CAUL) of customer data allows 
companies, primarily through new marketing 
processes to utilize databases of customer 
information to gain a competitive advantage. The 
CAUL of data without concern for ethical 
considerations is an additional point of knowledge 
in being an informed consumer and user of the 
data. 

3. COURSE LEARNING OBJECTIVES 

At the author's institution, this course is part of 
the business foundation taught to all business 
majors within the AACSB-accredited program. 
The course is modeled on the IS2010.07 
guidelines for a course in IS Strategy, 
Mangement, and Acquisition (Topi, H.; Valacich, 
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J.S..; Wright, R.T.; Kaiser, K.; Nunamaker, J.F.; 
Sipior, J. C.; and de Vreede, G.J., 2010). Like in 
the model curriculum this course is taught as part 
of a two course capstone sequence for all 
business majors. 

In particular, the objectives of the course, as 
taken directly from the course syllabus, state that 
the course 

"provides a conceptual framework for 
introducing, integrating, using, and 
leveraging enterprise-level information 
systems in today's enterprises. The key 
elements of successful information system 
development will be defined during the early 
part of the course and these will be used 
extensively throughout discussions and 
analyses of case studies. Taking a 
middle/upper-management point of view, the 
course focuses on the changes and impacts 
within organizations that need to be 
accounted for in strategic planning and 
organizational decision-making. The course 
prepares students to participate in enterprise 

information _ systems _ development 

discussions as a member of a team ." (Course 
Syllabus) 

While neither the course objectives nor the 
description of the IS2010.07 course specifically 
mentions the inclusion of privacy, the model 
curriculum (Topi, et al. 2010) does list privacy as 
a knowledge area important to all IS majors 
(Topi, et al., 2010, p. 422). 

Mason (1986) stated that two forces that inhibit 
privacy: the growth of information technology 
and the increased value of information. In this 
particular course students are exposed to four 
particular perspectives with regard to the CAUL of 
personal data: (1) the collection of data from 
multiple sources without the explicit knowledge or 
permission of consumers, (2) the use of 
techniques, such as analytics, to leverage 
consumer data to create consumer profiles, (3) 
the buying and selling of consumer data by 
companies to/from data brokers, and (4) the 
loss/exposure of consumer data through data 
breaches. 

The collection of data stems from the use of 
information technologies that act as sources of 
data. Traditional technologies such as RFID and 
webpages and even everyday appliances such as 
televisions and toys. With the growth of the 
Internet of Things (IoT) technologies this 
collection will only continue to grow. 
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Analytics, while a highly useful technique to any 
enterprise, has a dark side as well; Davenport et 
al. (2007). The ability to find patterns of 
consumer behavior in multiple, otherwise 
heterogeneous data sets has become easier and 
more prevalent. Combine this with the use of 
personally identifiable information collected from 
web browsing and enterprises have a powerful 
new marketing tool to help attract and keep 
customers; without regard to their customer's 
privacy. 

"Data brokers are companies that collect and 
aggregate consumer information from a wide 
range of sources to create detailed profiles of 
individuals" (Privacy Rights Clearinghouse, Fact 
Sheet 41: Data Brokers and Your Privacy, n.d.) 
Nearly 4,000 companies make up this $200B 
industry. Many of these firms work "under the 
radar" without government regulation buying, 
aggregating, and reselling this data (Federal 
Trade Commission, 2014). 

Data breaches seem to be an everyday 
occurrence. To date for 2016 (as of 6/28/2016), 
a total of 500 "reported" breaches have exposed 
over 12 million customer records; many more 
data breaches go unreported. About 33% of 
these breaches involve healthcare or medical 
records (Identity Theft Resource Center, 2016). 

These topics relate to course objectives dealing 
with the use/misuse of information technology 
and on the ethics of the CAUL of personal data. 

4. COURSE ACTIVITIES 

The course activities were similar in each offering 
(Fall 2015 and Spring 2016) of the course; minor 
refinements were made in the Spring 2016 
course. 

The students were introduced to the topic of 
privacy in three prominent ways. An initial 
lecture was presented that discussed the issue of 
privacy and the laws (and lack thereof) regarding 
data privacy. This lecture included some 
historical context on the development of the issue 
of privacy in US law as well as some examples of 
what information is considered private and what 
is not private. For example, in all states—except 
FL, ME, CT, MA, and Washington, DC—the books 
you check out of a library are considered private 
data. 

Next, a series of readings, primarily from the 
Privacy Rights Clearinghouse and the viewing of 
a 60 Minutes story dealing with the data 
brokerage industry were assigned. 
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The Privacy Rights Clearinghouse is non-profit 
organization that provides "information and tools" 
to consumers to empower them to take action to 
protect their own privacy (Privacy Rights 
Clearinghouse, n.d.). The web site contains 
information and access to documents on data 
breaches and data brokers. The students in 
particular read the Federal Trade Commision 
(FTC) report on data brokers (Federal Trade 
Commission, 2014). 

The readings and the 60 Minutes video (The Data 
Brokers, 2014) highlight the primary functions of 
the data brokerage industry and the types of data 
bought, aggregated, and sold by these firms. 
After these readings and videos were discussed in 
class a short assignment was given to assess the 
level of understanding gained by the students 
from this section of the course. 

The next exercise that the students engaged in 
during the semester was to collect data stories 
that addressed issues of data privacy. These data 
stories extended the idea presented by 
Pomykalski (Pomykalski, 2015) to attempt to 
create a contemporary issues journal (Barkley, 
2009). 

The students were required to find at least two 
"current event" articles. These stories (see 
(Pomykalski, 2015)) were analyzed using a fairly 
standard ethics assessment rubric where the 
students were required to examine the article as 
an ethical dilemma (see Appendix 1 for more 
details). 

Finally, as part of a team project, examining the 
use of analytics by various industry groups, the 
students examined issues of ethics (largely 
privacy) by these industries (see Appendix 2). 

5. FUTURE PLANNED EXTENSIONS 

In this first attempt at the introduction of privacy 
issues into this IS2010.07 course, the readings 
and activities met expectations, however, 
additional readings and assignments are planned 
for the future; specific focus areas currently 
under consideration are healthcare and social 
media. 

Given the great number of data breaches in the 
healthcare field, the privacy of patient data is at 
risk. By allowing students to investigate the 
impacts of having healthcare information 
compromised it is hoped that they come to a 
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better understanding of the need to safeguard all 
consumer data. 

Through the submission of the numerous data 
stories, students found that many of privacy 
violations dealt with data extracted from social 
media. Facebook, for example, has been been 
guilty of violating the privacy of users' data by 
conducting "studies" without the consent or 
knowledge of users (Arthur, 2014). Additionally, 
Facebook is collaborating "with health industry 
experts and entrepreneurs" to create health apps 
and discussion groups. These apps will cluster 
users based on their particular health conditions. 
Some social media watchers are concerned about 
privacy issues with regard to this data (Miliard, 
2014). Social media is prevalent in the lives of 
most of these students, therefore understanding 
the risks, both personally and professionally, of 
having personal information compromised might 
lead many of them to have more control over 
what they post. 

New readings are being reviewed and the 
development of new assignments are underway. 
The fuller realization of the contemporary issues 
journal (Barkley, 2009; Bean, 2011) is also 
planned for the next time this course is taught. 

6. CONCLUSIONS/SUMMARY 

The primary motivation for the introduction of the 
concept of privacy in this particular course is to 
enlighten students as to the multiple ways data is 
collected, analyzed, used, and leveraged to gain 
important insights into consumer behavior. More 
importantly though, the goal is to make students 
aware that they need to be good stewards of their 
own data and, in turn, conscious stewards for 
other consumer's data in their professional 
experiences. The recognition and understanding 
of ethical situations is an important component of 
acting with integrity (EPS Cloud Fabric, 2012). 

Comments, by the students as part of a reflective 
exercise on the final exam, showed that a number 
of students were both enlightened and intrigued 
by the lack of privacy in the handling of consumer 
data. Many of the students admitted that before 
this course that had not heard of the data 
brokerage industry. Some students were made 
more "self-aware" of how their data is used by 
marketers and social media companies. One 
student even commented on the value of the 
ethical dilemma assessments stating that they 
add value by being to apply their knowledge to 
current events. 

Through the readings and exercises presented in 
this course, many students developed an 
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awareness and appreciation of a topic that was 
not significant in their lives due to their own 
"privacy conception" (Steijn & Vedder, 2015). It 
is the author's hope that this awareness and 
appreciation carries forth in their professional 
lives. 
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APPENDIX 1: Data Stories Submission Template 

INFS 472: Management Support Systems 
Spring 2015 - Dr. Pomykalski 

Name:_ Story #:_/6 

Presentation (in class) Date:_ Submission (written) Date:_ 

Article Title: 

Article Source: 

Article Date: 

Summary: 

Relationship to Data+Enterprise Systems-Strategies: 

For each of the three stories you will identify and state the facts as best you can in the 
form of an ethical dilemma with respect to (at least) one of the major stakeholders. You 
will then generate alternative courses of action and assess the ethics of each of your 
courses of action. You will conclude the paper with a justified choice of action based on 
your ethical analysis. A recommended outline is given below. 

1. Introduction 

2. Ethical Issues 

3. Stakeholders 

4. Alternative Courses of Action 

a. Alternative 1 

b. Alternative 2 ... 

c. Alternative n 

5. Ethical Assessment of Each Alternative 

a. Alternative 1 

b. Alternative 2 ... 

c. Alternative n 

6. Conclusion (your choice with support) 

7. Bibliography/Works Cited/References 
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APPENDIX 2: Analytic Use in Industry Assignment 


Team Project 

Industry Use of DDDM/Analytics Techniques 

Goal : Gain an in-depth understanding of the applicability of data-driven decision-making 
(DDDM)/“analytics” within a particular industry. 

Overview : The focus of this team-based investigation is to understand how 
DDDM/analytics is used within a particular industry in the “real-world”. In an oral and then 
written presentation, each group will report on their findings of how “analytics” and data- 
driven decision-making is being performed within a particular industry. The deliverables 
for this investigation, and their due dates, are listed below. 


Group Members (4 Max)/Topic Selection: 

EMail deliverable: Friday, October 30 th 

Industry Selections: 

EMail deliverable: Friday, November 6 th 

Oral Presentation: 

December 2, 4, and 7th 

Written Report: 

Next class day after presentation 

Team/Peer Evaluation (Individual): 

Individual Report: Friday, December 11 th 


Please note that a large portion of the final project grade (80%) will be a jointly assigned 
group grade and the final 20% will be assigned individually; this individual grade will be 
on a personal contribution and group interaction statement. Based on the consistency of 
the statement across the group, your instructor reserves the right to reduce the assigned 
group grade for any one individual in the group. In other words, if you do not put in the 
effort then you will not be able to share fully in the assigned group grade. 

A description of the deliverables is given below; see the table above for due dates. 

Group Member Selection (2.5%): This simple deliverable is the selection of a team (of 
your choice) of no more than four individuals from your section of the course. Once the 
team is chosen, one team member will be responsible for sending me an EMail with the 
names of the individual members of the team. 

Industry Selection (5%): Each team will be responsible for creating a ranked list of at 
least three industries that wish to investigate for the use of DDDM/analytics. Your team 
may choose any industry. Examples of particular industries include (but are not limited 
to): Automotive, Banking, Consumer Products, Education, Electronics, Energy and 
Utilities, Financial markets, Government, Healthcare, Insurance, Law Enforcement, 
Metals and Mining, Media, Oil & Gas, Retail, Telecommunications, Travel and 
Transportation or you may make your selection from any Professional Sports area such 
as the MLB, NFL, NBA, Professional Soccer, etc. For introductory information on 
industries see: http://www.ibm.com/analytics/us/en/industry/. 
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Oral Presentation (40%): Each team will make a 20 to 25 minute oral presentation (on 
one of the dates listed above) that describes the use of DDDM/analytics within their 
industry. All team members will be expected to be present and make a contribution to 
the presentation. The presentation will include (at a minimum) the following: 

1. A brief overview of the industry that describes the need for DDDM/analytics within that 
industry, 

2. A review of the major issues in that industry that shows the factors driving that industry 
toward the use of DDDM/analytics, 

3. An in-depth analysis of at least one enterprise in the industry as to how DDDM/analytics 
is applied, 

4. A discussion of the major impediments left to overcome for more wide-spread use of 
DDDM/analytics in the industry, 

5. A discussion of the ethics related issues respect to DDDM/analytics usage, 

6. A final summary of the salient points of the presentation. 

Written Report (32.5%): The written report part of the work will be completed as a set of 
extended notes to be included with the PowerPoint slides. Each of the slides in the 
presentation will include a one page (approximately two to three paragraphs) discussion 
of more detail on the material included in the slide. This will include outside sources (in 
proper APA format), where appropriate, as well. Please note that the entire presentation 
(and notes) should have (at a minimum) five “new” sources that were used to create the 
presentation by the team. Grading on the presentation and the notes will be based on 
completeness, accuracy, and writing criteria. The writing criteria will be similar to the 
previous deliverables submitted in class. 

Team/Peer Evaluation (20%): The final deliverable, which is to be developed individually 
by each group member, will discuss—in 600-900 words— (1) the overall working 
relationship and discussion of roles within the group, (2) your individual contribution to the 
project, (3) a discussion on the division of labor that existed within the group, (4) the 
individual performance of each of the other members of the team; see the list below for 
suggested evaluation criteria, and (5) at least one individual lesson learned through the 
interactions within the group; this is not about content of the project. The criteria you 
should choose to use to judge your peers are: 

1. On an individual basis, did they make substantial contributions to preparation of the team 
deliverables? In other words, was the team member adequately prepared for team activities? 

2. On an individual basis, did they make productive contributions in team meetings? In other words, 
did this member contribute productively to group discussion, work and leadership during your 
team meetings? 

3. On an individual basis, did the team member facilitate the contributions of other team members? 

In other words, did the team member encourage others to contribute their ideas? 

4. On an individual basis, did the team member foster a constructive team climate? In other words, 
did the team member help to build a constructive team by fostering mutual respect? 

5. On an individual basis, how did the team member respond to conflict or differences within the 
team? In other words, did the team member engage conflicts in a manner that strengthened the 
overall team cohesiveness and future effectiveness? 
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